- Freeradius-Users - lists.freeradius.org

freeradius + sqlippool
by Konstantin Chekushin 15 Jan '10

15 Jan '10

Good afternoon! I have a question. It is necessary to assign ip-address by RADUIS-server to gprs user. My decision is to use freeradius+sqlippool for this purpose . But there is one problem. ippool name is initially unknown. It should be taken depending on a phone number. I.e. there is one more table in my database, where is a conformity - number (calling station id)=ip pool. (If calling-station-id does not present in the table  - RADIUS takes default ippool name.) Is there a good way to realize the similar scheme? Thanks for advices.

2 2

freeRADIUS talk to multiple AD forests
by John 15 Jan '10

15 Jan '10

Hello, We are using freeRADIUS-1.1.6. The backend server is Active directory. It can work well for single AD forest (A.com). We are using Global catalog port 3286 to get attribute from A.com. We want to support another forest (B.com) which is trust with A.com. unfortunatly Global catalog can not access different forests info. How can we get attrubutes from these AD forests? If we do not configure another LDAP instance for B.com. Is there a way to get attributes from B.com? Best. John ___________________________________________________________ 好玩贺卡等你发，邮箱贺卡全新上线！ http://card.mail.cn.yahoo.com/

2 1

Server Certificate Signing Request Question
by Ben Wiechman 14 Jan '10

14 Jan '10

I am generating a CSR for Verisign (WiMAX) to support EAP-TTLS. Some of the examples I see use the -nodes switch when generating the CSR, and others do not. Is the use of nodes CA specific, or why would I want to or not want to use -nodes. I see that when it is used the private key will not be encrypted, but I'm afraid I don't understand the ramifications of that. Any help or a link to a helpful RTFM would be greatly appreciated. Ben

1 0

RADIUS comparison tee
by John Morrissey 14 Jan '10

14 Jan '10

In moving our RADIUS infrastructure to FreeRADIUS, I wrote a tee to transparently compare FreeRADIUS' responses with those of our existing Radiator installations. It sniffs RADIUS traffic on the current machine, replays the requests to another RADIUS server, and compares the received responses with the sniffed responses. Differences are emitted to stdout, and known differences can be configured so they're automatically ignored. http://horde.net/~jwm/software/misc/comparison-tee john -- John Morrissey _o /\ ---- __o jwm(a)horde.net _-< \_ / \ ---- < \, www.horde.net/ __(_)/_(_)________/ \_______(_) /_(_)__

1 0

Auth-Type and Group precedence
by liran tal 14 Jan '10

14 Jan '10

Hey guys, Setting an Auth-Type := Accept to a user while also associating the same user to a group with Auth-Type := Reject results in a successful login of the user due to the Auth-Type := Accept in radcheck table taking precedence. Is it possible to give a higher priority to the group association? System is a FreeRADIUS 1.1.7 install with a mysql database backend. Regards, Liran.

1 0

Freeradius 2.x + MySQL: Failed to authenticate the user
by Alexander 14 Jan '10

14 Jan '10

Hello all, I have a new setup with Freeradius 2.1.7, Dialup Admin 1.80 and MySQL 5.0.77 running under Red Hat ES 5.4. Access from Freeradius to MySQL is working fine but user 'dummy' does not get authenticated. After hours of searching through my setup it seems to me that the problem is rather related to my Freeradius configuration than to MySQL. I tested locally with radtest and remotly with NTRadPing: Access-Reject. From the attached debug output can you see why? Thanks in advance! Cheers, Alexander

2 2

Framed-IP user gets access-reject due to CHAP
by Tevfik Ceydeliler 14 Jan '10

14 Jan '10

Hi list, I have two types user. One of them get IP address from pool. Other one must use static IP address. There is no problem with users use IP pool. But users ,using static IP , get Access-Reject. I have two debug output. And I use my account name to test. First I put my account into pooli then I put my account with static Ip address. In each tests I comment other raw. Here is the users file : -For Ip pool test: tevfikceydeliler Service-Type == Framed-User,Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Pool-Name := BirmasGPRS_pool #tevfikceydeliler Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Framed-IP-Address := 172.30.65.90, Framed-IP-Netmask := 255.255.240, Fall-Through = Yes -For static IP test: #tevfikceydeliler Service-Type == Framed-User,Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Pool-Name := BirmasGPRS_pool tevfikceydeliler Packet-Type==Access-Request, Proxy-To-Realm := 10.1.1.51, Framed-IP-Address := 172.30.65.90, Framed-IP-Netmask := 255.255.240, Fall-Through = Yes I also have debug output for these two test: -For Ip pool test: rad_recv: Access-Request packet from host 172.30.80.1 port 1048, id=181, length=139 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 119530800 CHAP-Challenge = 0x084c2d1eb2b0da2fa88e86be50190074 User-Name = "tevfikceydeliler" CHAP-Password = 0x01fe1f5c6c3340f451ba829a456b302ece Calling-Station-Id = "905308507313" Thu Jan 14 10:05:39 2010 : Info: +- entering group authorize {...} Thu Jan 14 10:05:39 2010 : Info: ++[preprocess] returns ok Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/auth-detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/auth-detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[auth_log] returns ok Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[detail] returns ok Thu Jan 14 10:05:39 2010 : Info: [chap] Setting 'Auth-Type := CHAP' Thu Jan 14 10:05:39 2010 : Info: ++[chap] returns ok Thu Jan 14 10:05:39 2010 : Info: ++[mschap] returns noop Thu Jan 14 10:05:39 2010 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL Thu Jan 14 10:05:39 2010 : Info: [suffix] No such realm "NULL" Thu Jan 14 10:05:39 2010 : Info: ++[suffix] returns noop Thu Jan 14 10:05:39 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Jan 14 10:05:39 2010 : Info: ++[eap] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[unix] returns notfound Thu Jan 14 10:05:39 2010 : Info: [files] users: Matched entry tevfikceydeliler at line 114 Thu Jan 14 10:05:39 2010 : Debug: expand: Hello, %{User-Name} -> Hello, tevfikceydeliler Thu Jan 14 10:05:39 2010 : Info: ++[files] returns ok Thu Jan 14 10:05:39 2010 : Info: ++[expiration] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[logintime] returns noop Thu Jan 14 10:05:39 2010 : Info: +- entering group pre-proxy {...} Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/pre-proxy-detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [pre_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/pre-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/pre-proxy-detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[pre_proxy_log] returns ok Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[detail] returns ok Sending Access-Request of id 218 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 119530800 CHAP-Challenge = 0x084c2d1eb2b0da2fa88e86be50190074 User-Name = "tevfikceydeliler" CHAP-Password = 0x01fe1f5c6c3340f451ba829a456b302ece Calling-Station-Id = "905308507313" Proxy-State = 0x313831 Thu Jan 14 10:05:39 2010 : Info: Proxying request 0 to home server 10.1.1.51 port 1812 Sending Access-Request of id 218 to 10.1.1.51 port 1812 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 119530800 CHAP-Challenge = 0x084c2d1eb2b0da2fa88e86be50190074 User-Name = "tevfikceydeliler" CHAP-Password = 0x01fe1f5c6c3340f451ba829a456b302ece Calling-Station-Id = "905308507313" Proxy-State = 0x313831 Thu Jan 14 10:05:39 2010 : Debug: Going to the next request Thu Jan 14 10:05:39 2010 : Debug: Waking up in 0.9 seconds. rad_recv: Access-Accept packet from host 10.1.1.51 port 1812, id=218, length=25 Proxy-State = 0x313831 Thu Jan 14 10:05:39 2010 : Info: +- entering group post-proxy {...} Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/post-proxy-detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [post_proxy_log] /var/log/freeradius/radacct/%{Client-IP-Address}/post-proxy-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/post-proxy-detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[post_proxy_log] returns ok Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[detail] returns ok Thu Jan 14 10:05:39 2010 : Info: [eap] No pre-existing handler found Thu Jan 14 10:05:39 2010 : Info: ++[eap] returns noop Thu Jan 14 10:05:39 2010 : Info: Found Auth-Type = CHAP Thu Jan 14 10:05:39 2010 : Info: Found Auth-Type = Accept Thu Jan 14 10:05:39 2010 : Error: Warning: Found 2 auth-types on request for user 'tevfikceydeliler' Thu Jan 14 10:05:39 2010 : Info: Auth-Type = Accept, accepting the user Thu Jan 14 10:05:39 2010 : Auth: Login OK: [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 119530800 cli 905308507313) Thu Jan 14 10:05:39 2010 : Info: +- entering group post-auth {...} Thu Jan 14 10:05:39 2010 : Info: ++[TCELL_pool] returns noop Thu Jan 14 10:05:39 2010 : Debug: expand: %{NAS-IP-Address} %{NAS-Port} -> 172.30.80.1 119530800 Thu Jan 14 10:05:39 2010 : Info: [BirmasGPRS_pool] MD5 on 'key' directive maps to: 860ffa91b70d5bb8b649d5ee042c87ea Thu Jan 14 10:05:39 2010 : Info: [BirmasGPRS_pool] Searching for an entry for key: '860ffa91b70d5bb8b649d5ee042c87ea' Thu Jan 14 10:05:39 2010 : Debug: rlm_ippool: Allocating ip to key: '860ffa91b70d5bb8b649d5ee042c87ea' Thu Jan 14 10:05:39 2010 : Info: [BirmasGPRS_pool] num: 1 Thu Jan 14 10:05:39 2010 : Info: [BirmasGPRS_pool] Allocated ip 172.30.64.80 to client key: 860ffa91b70d5bb8b649d5ee042c87ea Thu Jan 14 10:05:39 2010 : Info: ++[BirmasGPRS_pool] returns ok Thu Jan 14 10:05:39 2010 : Info: ++[PSUOtonom_pool] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[YBPOtonom1_pool] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[YBPOtonom2_pool] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[YBPOtonom3_pool] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[Turkcell3G_pool] returns noop Thu Jan 14 10:05:39 2010 : Info: ++[PsuYBP2Ortak_pool] returns noop Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/reply-detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/reply-detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[reply_log] returns ok Thu Jan 14 10:05:39 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:05:39 2010 : Debug: expand: %t -> Thu Jan 14 10:05:39 2010 Thu Jan 14 10:05:39 2010 : Info: ++[detail] returns ok Thu Jan 14 10:05:39 2010 : Info: ++[exec] returns noop Sending Access-Accept of id 181 to 172.30.80.1 port 1048 Framed-IP-Address = 172.30.64.80 Framed-IP-Netmask = 255.255.240.0 Thu Jan 14 10:05:39 2010 : Info: Finished request 0. Thu Jan 14 10:05:39 2010 : Debug: Going to the next request Thu Jan 14 10:05:39 2010 : Debug: Waking up in 4.9 seconds. Thu Jan 14 10:05:44 2010 : Info: Cleaning up request 0 ID 181 with timestamp +45 Thu Jan 14 10:05:44 2010 : Debug: Ready to process requests. -For Static IP test: rad_recv: Access-Request packet from host 172.30.80.1 port 3820, id=232, length=139 NAS-IP-Address = 172.30.80.1 NAS-Identifier = "GGFILE02" Called-Station-Id = "yasarapn" Framed-Protocol = GPRS-PDP-Context Service-Type = Framed-User NAS-Port-Type = Virtual NAS-Port = 32285232 CHAP-Challenge = 0xae0e7eb20e1df67194bcedd4c205f843 User-Name = "tevfikceydeliler" CHAP-Password = 0x01fb5a4bf58cd585c42cde13b49b6ae11b Calling-Station-Id = "905308507313" Thu Jan 14 10:07:46 2010 : Info: +- entering group authorize {...} Thu Jan 14 10:07:46 2010 : Info: ++[preprocess] returns ok Thu Jan 14 10:07:46 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/auth-detail-20100114 Thu Jan 14 10:07:46 2010 : Info: [auth_log] /var/log/freeradius/radacct/%{Client-IP-Address}/auth-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/auth-detail-20100114 Thu Jan 14 10:07:46 2010 : Debug: expand: %t -> Thu Jan 14 10:07:46 2010 Thu Jan 14 10:07:46 2010 : Info: ++[auth_log] returns ok Thu Jan 14 10:07:46 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:07:46 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:07:46 2010 : Debug: expand: %t -> Thu Jan 14 10:07:46 2010 Thu Jan 14 10:07:46 2010 : Info: ++[detail] returns ok Thu Jan 14 10:07:46 2010 : Info: [chap] Setting 'Auth-Type := CHAP' Thu Jan 14 10:07:46 2010 : Info: ++[chap] returns ok Thu Jan 14 10:07:46 2010 : Info: ++[mschap] returns noop Thu Jan 14 10:07:46 2010 : Info: [suffix] No '@' in User-Name = "tevfikceydeliler", looking up realm NULL Thu Jan 14 10:07:46 2010 : Info: [suffix] No such realm "NULL" Thu Jan 14 10:07:46 2010 : Info: ++[suffix] returns noop Thu Jan 14 10:07:46 2010 : Info: [eap] No EAP-Message, not doing EAP Thu Jan 14 10:07:46 2010 : Info: ++[eap] returns noop Thu Jan 14 10:07:46 2010 : Info: ++[unix] returns notfound Thu Jan 14 10:07:46 2010 : Info: ++[files] returns noop Thu Jan 14 10:07:46 2010 : Info: ++[expiration] returns noop Thu Jan 14 10:07:46 2010 : Info: ++[logintime] returns noop Thu Jan 14 10:07:46 2010 : Info: Found Auth-Type = CHAP Thu Jan 14 10:07:46 2010 : Info: +- entering group CHAP {...} Thu Jan 14 10:07:46 2010 : Info: [chap] login attempt by "tevfikceydeliler" with CHAP password Thu Jan 14 10:07:46 2010 : Info: [chap] Cleartext-Password is required for authentication Thu Jan 14 10:07:46 2010 : Info: ++[chap] returns invalid Thu Jan 14 10:07:46 2010 : Info: Failed to authenticate the user. Thu Jan 14 10:07:46 2010 : Auth: Login incorrect (rlm_chap: Clear text password not available): [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 32285232 cli 905308507313) Thu Jan 14 10:07:46 2010 : Info: Using Post-Auth-Type Reject Thu Jan 14 10:07:46 2010 : Info: +- entering group REJECT {...} Thu Jan 14 10:07:46 2010 : Debug: expand: %{User-Name} -> tevfikceydeliler Thu Jan 14 10:07:46 2010 : Debug: attr_filter: Matched entry DEFAULT at line 11 Thu Jan 14 10:07:46 2010 : Info: ++[attr_filter.access_reject] returns updated Thu Jan 14 10:07:46 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:07:46 2010 : Info: [detail] /var/log/freeradius/radacct/%{Client-IP-Address}/detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/detail-20100114 Thu Jan 14 10:07:46 2010 : Debug: expand: %t -> Thu Jan 14 10:07:46 2010 Thu Jan 14 10:07:46 2010 : Info: ++[detail] returns ok Thu Jan 14 10:07:46 2010 : Debug: expand: /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d -> /var/log/freeradius/radacct/172.30.80.1/reply-detail-20100114 Thu Jan 14 10:07:46 2010 : Info: [reply_log] /var/log/freeradius/radacct/%{Client-IP-Address}/reply-detail-%Y%m%d expands to /var/log/freeradius/radacct/172.30.80.1/reply-detail-20100114 Thu Jan 14 10:07:46 2010 : Debug: expand: %t -> Thu Jan 14 10:07:46 2010 Thu Jan 14 10:07:46 2010 : Info: ++[reply_log] returns ok Thu Jan 14 10:07:46 2010 : Info: Delaying reject of request 0 for 3 seconds Thu Jan 14 10:07:46 2010 : Debug: Going to the next request Thu Jan 14 10:07:46 2010 : Debug: Waking up in 0.9 seconds. Thu Jan 14 10:07:47 2010 : Debug: Waking up in 1.9 seconds. Thu Jan 14 10:07:49 2010 : Info: Sending delayed reject for request 0 Sending Access-Reject of id 232 to 172.30.80.1 port 3820 Thu Jan 14 10:07:49 2010 : Debug: Waking up in 4.9 seconds. Thu Jan 14 10:07:54 2010 : Info: Cleaning up request 0 ID 232 with timestamp +52 Thu Jan 14 10:07:54 2010 : Debug: Ready to process requests. There is some raw differet ofcourse: The test for IP Pool, conenction request enter preproxy. But test for static IP conenction goes directly "Auth-Type := CHAP". So the problem begins after this , because I get following messages: Thu Jan 14 10:07:46 2010 : Info: [chap] login attempt by "tevfikceydeliler" with CHAP password Thu Jan 14 10:07:46 2010 : Info: [chap] Cleartext-Password is required for authentication Thu Jan 14 10:07:46 2010 : Info: ++[chap] returns invalid Thu Jan 14 10:07:46 2010 : Info: Failed to authenticate the user. Thu Jan 14 10:07:46 2010 : Auth: Login incorrect (rlm_chap: Clear text password not available): [tevfikceydeliler/<CHAP-Password>] (from client turkcellAPN port 32285232 cli 905308507313) I know that my IP pool names located in ../sites-enabled/default file under accounting and post-auth section. Question is where can I put my user ,using static IP, that freeraidus behave like my user is IP pool user? I lost my way. I read many list posts but I can get a appropriate answer. Regards. Tevfik Ceydeliler Bu elektronik postada bulunan tum fikir ve gorusler ve ekindeki dosyalar sadece adres sahip/sahiplerine ait olup, Yasar Toplulugu Sirketleri bu mesajin icerigi ile ilgili olarak hic bir hukuksal sorumlulugu kabul etmez. Eger gonderilmesi dusunulen kisi veya kurulus degilseniz, lutfen gonderen kisiyi derhal haberdar ediniz ve mesaji sisteminizden siliniz.The information contained in this e-mail and any files transmitted with it are intended solely for the use of the individual or entity to whom they are addressed and Yasar Group Companies do not accept legal responsibility for the contents. If you are not the intended recipient, please immediately notify the sender and delete it from your system.

2 1

Authentification using MS-CHAP with Active Directory
by Noro Hasina 14 Jan '10

14 Jan '10

Hi everybody, My project have changed, and I should use Active Directory instead of mysql for authentication because we use AD for user's domain administration. My server can join the domain but my problem is that ms-chap does'nt do anything during radtest. here is the result when i run radiusd -X the module is linked *module mschap* Module: Linked to module rlm_mschap Module: Instantiating mschap mschap { use_mppe = yes require_encryption = yes require_strong = yes with_ntdomain_hack = yes ntlm_auth = "/usr/bin/ntlm_auth --request-nt-key --username=%{mschap:User-Name:-None} --domain=%{%{mschap:NT-Domain}:-CELTELMG} --challenge=%{mschap:Challenge:-00} --nt-response=%{mschap:NT-Response:-00}" } After the Ready to process requests, I run # radtest testuser testuser localhost 0 pass and here but mschap isn't used : rad_recv: Access-Request packet from host 127.0.0.1 port 45703, id=64, length=60 User-Name = "testuser" User-Password = "testuser" NAS-IP-Address = xxxxxxxx NAS-Port = 0 +- entering group authorize {...} ++[preprocess] returns ok ++[chap] returns noop ++[mschap] returns noop Anyone could help me please!

2 2

Re: OpenDirectory on Mac OS X 10.6 authenticating Cisco ASA
by mail＠wetzelandson.com 13 Jan '10

13 Jan '10

Alan, Thanks. Missed that in some of the sites I have been searching. Using radiusd -X debugging mode I found an addition I had made to /etc/raddb/users trying to tell it to use Open Directory (this was required in 10.5 to make this work) was the source of all my problems. Seems to work now. Apple actually made this easier for us in their implementation and the only change required now is to add the client to /etc/raddb/clients.conf and the Open Directory user is processed correctly. No changes in /etc/raddb/users at all. Thanks for pointing out the obvious to me. -Erich > mail(a)wetzelandson.com wrote: >> Is there something further I can give to you that would help you >> understand what is happening or what I am looking to do? The issue >> appears to be the selection of Auth-Type = opendirectory does not seem >> to >> work in 10.6. > > Run the server in debugging mode. > > Alan DeKok. > >

1 0

NT/LM password from LDAP (PAP works, MSCHAP doesn't).
by Lech Karol Pawłaszek 13 Jan '10

13 Jan '10

Hello. I've working FreeRADIUS installation for 802.1x authentication and authorization using EAP-TLS with passwords - NT/LM hashes - stored in LDAP. And it works nice. Right now I'm deploying (yes. at this particular moment!) IPsec/L2TP VPN which will be utilizing RADIUS via ppp connection. And for PAP it works nice. However MSCHAP doesn't want to work. I'm kinda lost because EAP connection uses MSCHAP(v2) as well and this one works flawlessly. ;-) Am I missing something? I believe it should work. Or it cannot? I've attached FreeRADIUS' logfile. Any pointers/hints much appreciated. Kind regards, -- Lech Karol Pawłaszek <ike> "You will never see me fall from grace" [KoRn]

2 2